CVE-2026-12975
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Schwachstellenklasse
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
Betroffene Produkte
- redhat build_of_apicurio_registry
Quellen
- https://access.redhat.com/errata/RHSA-2026:59360
- https://access.redhat.com/security/cve/CVE-2026-12975
- https://bugzilla.redhat.com/show_bug.cgi?id=2491688
- https://access.redhat.com/errata/RHSA-2026:59360
- https://access.redhat.com/security/cve/CVE-2026-12975
- https://bugzilla.redhat.com/show_bug.cgi?id=2491688
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.